Implement PEP-708 - Extend the repository API to mitigate "dependency confusion" attacks
還沒有人認領這個 Issue。
評估
研究方向
Start by reading PEP-708 and the linked Simple Repository API specification. The issue names no files or tests; done means extending the repository API to support project tracking and namespace extension as specified, with coverage for the dependency-confusion protections.
由索引模型根據 Issue 內容生成。
描述
Dependency confusion attacks, in which a malicious package is installed instead of the one the user expected, are an increasingly common supply chain threat. Most such attacks against Python dependencies, including the recent PyTorch incident, occur with multiple package repositories, where a dependency expected to come from one repository (e.g. a custom index) is installed from another (e.g. PyPI).
To help address this problem, this PEP proposes extending the Simple Repository API to allow repository operators to indicate that a project found on their repository “tracks” a project on different repositories, and allows projects to extend their namespaces across multiple repositories.
These features will allow installers to determine when a project being made available from a particular mix of repositories is expected and should be allowed, and when it is not and should halt the install with an error to protect the user.
- 主要語言
- Python
- 星號
- 49
- 分支
- 88
- 平均合併
- 1 天 10 小時
- 30 天內合併 PR
- 31
貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
pulp/pulp_python 的其他 Issue
-
難度 3/5 1-2 天 新手友好度 68/100
pulp/pulp_python#1381 ·
-
Feature Triage-Needed
難度 5/5 一週以上 新手友好度 45/100
pulp/pulp_python#1371 ·
-
難度 5/5 一週以上 新手友好度 45/100
pulp/pulp_python#1360 ·
-
難度 4/5 3-5 天 新手友好度 52/100
pulp/pulp_python#1358 ·
-
Feature
pulp/pulp_python#1340 · 已指派 1 人 ·
相似的 Issue
-
bug
難度 2/5 1-3 小時 新手友好度 86/100
zostera/django-bootstrap4#894 ·
-
難度 2/5 1-3 小時 新手友好度 78/100
use-agent-os/agent-os#3276 ·
-
難度 2/5 1-3 小時 新手友好度 88/100
zephyrproject-rtos/zephyr#119726 ·
-
area/auth bug comp/agent P3 platform/discord type/security
難度 2/5 1-3 小時 新手友好度 88/100
NousResearch/hermes-agent#117848 ·
-
難度 2/5 1-3 小時 新手友好度 82/100
zilliztech/memsearch#759 ·